sqlmap is a penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a detection engine, many niche features, and a broad range of switches including database fingerprinting, data fetching from the database, and accessing the underlying file system and executing commands on the operating system via out-of-band connections.

geoipgen is an IP network tool for generating geotargeted lists of IP addresses using MaxMind's GeoLite Country database. It can randomly enumerate all IP addresses or a specified number of IP addresses in a particular country or a list of countries. For example, to get all IPs for Japan in a random order, use "geoipgen jp". For a sample of 10,000 IPs from Australia and New Zealand, use "geoipgen -n 10000 au nz".

PRADS is a "Passive Real-time Asset Detection System". It passively listens to network traffic and gathers information on hosts and services it sees. This information can be used to map your network, letting you know what services and hosts are alive and used. It can also be used together with your favorite IDS/IPS setup for "event to host/service" correlation. It can help you make sure that your inventory database is up to date. PRADS commes in two versions. One written in Perl, and one written in C. Some features might only be found in one of the versions.

nessus-xmlrpc is a Ruby library for the Nessus XML-RPC interface. You can use it to start, stop, pause, and resume scans. It lets you watch progress and status of scans, download reports, etc. It comes with an example command line program that shows how easy it is to interact with the Nessus scanner.

Net::Nessus::XMLRPC is Perl interface for communication with the Nessus scanner over XMLRPC. It lets you start, stop, pause, and resume scans. It can display the progress and status of scans, download reports, etc.

WhatWeb identifies Websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognizes Web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, Web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognize something different. It also identifies version numbers, email addresses, account IDs, Web framework modules, SQL errors, and more. It can be stealthy and fast, or thorough but slow. It supports an aggression level to control the trade off between speed and reliability.

RubyDNS is a high-performance DNS server that can be easily integrated into other projects or used as a stand-alone daemon (via RExec). By default, it uses rule-based pattern matching. Results can be hard-coded, computed, fetched from a remote DNS server, or fetched from a local cache, depending on requirements. In addition, RubyDNS includes a high-performance asynchronous DNS resolver built on top of EventMachine. This module can be used by itself in client applications without using the full RubyDNS server stack.

HackIt! is a strategic game where your goal is to control as many Web sites as you can by hacking them. It is played on an infinite map (the whole Web) where hackers struggle for the control of the Internet. The game involves scanning sites to know who they belong to, hacking your friends' favorite pages, or tracking them to kick them out of the net.

HexInject is a hexadecimal and raw packet injector and sniffer. It can be easily combined with other tools to provide a powerful command line framework for raw network access. It will automatically set the correct checksum (IP, TCP, UDP, ICMP).